Build Trigger API Misconfiguration in Red Hat Quay

Executive Summary

This vulnerability in Red Hat Quay allows an authenticated user with admin access to any repository to view, modify, or delete build triggers and write tokens of another repository by providing the target trigger's UUID. The API endpoints for managing build triggers do not verify if the trigger UUID belongs to the specified repository.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, review Red Hat Quay API logs for unauthorized access attempts to /api/v1/repository/<repository>/trigger/<trigger_uuid> endpoints. Check for administrative actions performed by users not associated with the target repository. Monitor for unexpected modifications or deletions of build triggers.

Useful 0 Not Useful 0

Impact Analysis

An attacker could disrupt CI/CD pipelines by disabling or deleting build triggers, leading to failed builds or deployments. They could also steal write tokens to push unauthorized images to repositories, potentially compromising software integrity or leaking sensitive data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or modification of build artifacts, violating integrity requirements in GDPR and HIPAA. Compromised write tokens may enable tampering with software or data, risking non-compliance with data protection and audit standards.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the latest Red Hat Quay security patches immediately. Restrict administrative access to repositories to only necessary users. Rotate all build trigger write tokens and UUIDs. Monitor for suspicious activity in API logs. Consider disabling build trigger management if not actively used.

Useful 0 Not Useful 0